蓝屏求解决方案

lastpass

请大神提供解决方案， 分析出来是afd.sys导致的

malloc_440

0: kd> kv
ChildEBP RetAddr  Args to Child              
WARNING: Frame IP not in any known module. Following frames may be wrong.
9cf3abd8 938d90fc 9cf3abf8 81a4d976 887d4940 0xf4000413
9cf3abe0 81a4d976 887d4940 88e775f0 88e77a00 afd!AfdWskDispatchInternalDeviceControl+0x21 (FPO: [Non-Fpo])
9cf3abf8 938db71e 9cf3ac30 88e77a00 8b3efc10 nt!IofCallDriver+0x63
9cf3ac00 88e77a00 8b3efc10 9cf3ac30 9b983709 afd!WskProAPISend+0x67 (FPO: [Non-Fpo])
9cf3aca4 995ed1c5 88e7e040 88e7e040 81a4eed0 0x88e77a00
9cf3acb8 995edb8d 995be680 88e7e040 00000000 srv!ExecuteTransaction+0x101 (FPO: [0,0,4])
9cf3ad30 995b9de1 88b15058 88b15020 88e7e048 srv!SrvSmbTransaction+0x76f (FPO: [Non-Fpo])
9cf3ad54 995c8c23 00000000 88b16378 00000000 srv!SrvProcessSmb+0x151 (FPO: [Non-Fpo])
9cf3ad7c 81bdec42 00b15020 f273b98c 00000000 srv!WorkerThread+0x132 (FPO: [Non-Fpo])
9cf3adc0 81a47efe 995c8af1 88b15020 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
0: kd> lmvm afd
start    end        module name
938d6000 9391e000   afd        (pdb symbols)          d:\symbols\afd.pdb\607DAFDB2E334FB09CD2B7524EBB76DC2\afd.pdb
    Loaded symbol image file: afd.sys
    Mapped memory image file: d:\symbols\afd.sys\49E020C548000\afd.sys
    Image path: \SystemRoot\system32\drivers\afd.sys
    Image name: afd.sys
    Timestamp:        Sat Apr 11 12:47:01 2009 (49E020C5)
    CheckSum:         000517DC
    ImageSize:        00048000
    File version:     6.0.6002.18005
    Product version:  6.0.6002.18005
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     afd.sys
    OriginalFilename: afd.sys
    ProductVersion:   6.0.6002.18005
    FileVersion:      6.0.6002.18005 (lh_sp2rtm.090410-1830)
    FileDescription:  Ancillary Function Driver for WinSock
    LegalCopyright:   © Microsoft Corporation. All rights reserved.


是afd.sys在处理IRP_MJ_INTERNAL_DEVICE_CONTROL请求时发生崩溃，而afd.sys又是系统的和Winsock Kernel有关的一个驱动。问题应该发生在某个第三方软件的驱动对Winsock Kernel的过滤上。检查机器上是否安装了和网络传输过滤有关的软件（比如： 防火墙，WAF,IPS,IDS等等），卸载相应的软件，直到找到有问题的软件。

yibudengtian

看不到图像呀